UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
962
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Low 2.3

    CVE-2021-2042 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 20 Jan 2021 · NVD
  2. Medium 4.4

    CVE-2021-2038 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 20 Jan 2021 · NVD
  3. Medium 4.9

    CVE-2021-2036 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  4. Medium 4.3

    CVE-2021-2033 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in…

    Published 20 Jan 2021 · NVD
  5. Medium 4.3

    CVE-2021-2032 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset…

    Published 20 Jan 2021 · Fixed in 10.0.11 · NVD
  6. Medium 4.9

    CVE-2021-2031 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  7. Medium 4.9

    CVE-2021-2030 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  8. Medium 4.9

    CVE-2021-2028 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 20 Jan 2021 · NVD
  9. Medium 6.5

    CVE-2021-2024 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  10. Medium 4.4

    CVE-2021-2022 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 20 Jan 2021 · Fixed in 10.3.24, 10.4.14, 10.5.5 · NVD
  11. Medium 4.9

    CVE-2021-2021 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  12. Medium 6.5

    CVE-2021-2020 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  13. Low 2.7

    CVE-2021-2019 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 20 Jan 2021 · NVD
  14. High 8.3

    CVE-2021-2018 · Oracle WebLogic Server

    Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is…

    Published 20 Jan 2021 · NVD
  15. Medium 4.9

    CVE-2021-2016 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  16. Medium 4.9

    CVE-2021-2014 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  17. Medium 4.9

    CVE-2021-2012 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 20 Jan 2021 · NVD
  18. Medium 5.9

    CVE-2021-2011 · MariaDB, MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 20 Jan 2021 · Fixed in 10.0.35, 10.1.33, 10.2.15 · NVD
  19. Medium 4.2

    CVE-2021-2010 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update, insert or…

    Published 20 Jan 2021 · NVD
  20. Medium 4.9

    CVE-2021-2009 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  21. Low 3.7

    CVE-2021-2007 · MariaDB, MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a…

    Published 20 Jan 2021 · Fixed in 10.2.26, 10.3.17, 10.4.7 · NVD
  22. Medium 5.3

    CVE-2021-2006 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 8.0.19 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 20 Jan 2021 · NVD
  23. Medium 4.9

    CVE-2021-2002 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 20 Jan 2021 · NVD
  24. Medium 4.9

    CVE-2021-2001 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 20 Jan 2021 · NVD
  25. Low 3.8

    CVE-2021-1998 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of…

    Published 20 Jan 2021 · NVD
  26. Low 2.4

    CVE-2021-1996 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker.…

    Published 20 Jan 2021 · NVD
  27. Medium 6.5

    CVE-2021-1995 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or…

    Published 20 Jan 2021 · NVD
  28. Critical 9.8

    CVE-2021-1994 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.…

    Published 20 Jan 2021 · NVD
  29. Critical 9.8

    CVE-2021-3110 · PrestaShop

    The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter.

    Published 20 Jan 2021 · NVD
  30. Medium 6.1

    CVE-2021-24241 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 20 Jan 2021 · Fixed in 5.9.1 · NVD, WPVulnerability
  31. Critical 9.0

    CVE-2020-35128 · Mautic

    Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a…

    Published 19 Jan 2021 · Fixed in 2.16.5, 3.2.4 · NVD
  32. Medium

    CVE-2018-10189 · Mautic

    Sessions could be hijacked due to tracking contacts by an auto-incremented ID

    Published 19 Jan 2021 · Fixed in 2.13.0 · Project advisories (GitHub)
  33. Medium

    CVE-2018-8092 · Mautic

    CSV Injection vulnerability with exported contact lists

    Published 19 Jan 2021 · Fixed in 2.13.0 · Project advisories (GitHub)
  34. Critical 9.8

    CVE-2021-3177 · Python

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

    Published 19 Jan 2021 · NVD
  35. Medium 6.5

    CVE-2020-29450 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.

    Published 19 Jan 2021 · Fixed in 7.2.0 · NVD
  36. High

    GHSA-6fcp-57cp-fww9 · Metabase

    Metabase Enterprise Data Sandboxing and Caching Visibility Vulnerability

    Published 18 Jan 2021 · Fixed in 0.37.6 · Project advisories (GitHub)
  37. High 7.5Actively exploited

    CVE-2020-36193 · Drupal

    Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

    Published 18 Jan 2021 · Fixed in 8.9.13, 9.0.11, 9.1.3 · NVD
  38. High 7.8

    CVE-2021-3162 · Docker Engine

    Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.

    Published 15 Jan 2021 · Fixed in 2.5.0.0 · NVD
  39. Medium 6.5

    CVE-2021-22171 · GitLab

    Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link

    Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  40. Medium 6.5

    CVE-2021-22168 · GitLab

    A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.

    Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  41. High 7.5

    CVE-2021-22167 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository

    Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  42. High 7.5

    CVE-2021-22166 · GitLab

    An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

    Published 15 Jan 2021 · Fixed in 13.7.2 · NVD
  43. Medium 6.5

    CVE-2020-26414 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.

    Published 15 Jan 2021 · Fixed in 13.5.6, 13.6.4, 13.7.2 · NVD
  44. High

    CVE-2021-21263 · Laravel

    Query Binding Exploitation

    Published 15 Jan 2021 · Fixed in 6.20.12 · Project advisories (GitHub)
  45. High 7.5

    CVE-2020-35733 · Erlang/OTP

    An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.

    Published 15 Jan 2021 · Fixed in 23.2.2 · NVD
  46. Medium 4.8

    CVE-2021-22132 · Elasticsearch

    Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

    Published 14 Jan 2021 · Fixed in 7.10.2 · NVD
  47. Medium 5.3

    CVE-2020-29019 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header.

    Published 14 Jan 2021 · Fixed in 6.2.4 · NVD
  48. High 8.8

    CVE-2020-29018 · Fortinet FortiWeb

    A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.

    Published 14 Jan 2021 · NVD
  49. Critical 9.8

    CVE-2020-29016 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname.

    Published 14 Jan 2021 · Fixed in 6.2.4 · NVD
  50. Critical 9.8

    CVE-2020-29015 · Fortinet FortiWeb

    A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

    Published 14 Jan 2021 · Fixed in 6.2.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.